TITLE 1 GENERAL GOVERNMENT

CHAPTER 12 INFORMATION TECHNOLOGY

PART 7 DIGITAL / ELECTRONIC SIGNATURE

1.12.7.1 ISSUING AGENCY: State Commission of Public Records and State Records Administrator

[1.12.7.1 NMAC - Rp, NMAC 1.12.7.1, 7/1/2015]

1.12.7.2 SCOPE: To implement the electronic signature authority pursuant to the Public Records Act, Section 14-3-15.2 NMSA 1978 and the New Mexico Uniform Electronic Transactions Act, Section 14-16-1 et seq NMSA 1978.

[1.12.7.2 NMAC - Rp, NMAC 1.12.7.2, 7/1/2015]

1.12.7.3 STATUTORY AUTHORITY: Public Records Act, Section 14-3-15.2 NMSA 1978; Uniform Electronic Transactions Act, Section 14-16-1 et seq NMSA 1978.

[1.12.7.3 NMAC - Rp, NMAC 1.12.7.3, 7/1/2015]

1.12.7.4 DURATION: Permanent

[1.12.7.4 NMAC - Rp, NMAC 1.12.7.4, 7/1/2015]

1.12.7.5 EFFECTIVE DATE: July 1, 2015, unless a later date is cited at the end of a section.

[1.12.7.5 NMAC - Rp, NMAC 1.12.7.5, 7/1/2015]

1.12.7.6 OBJECTIVE: To establish standards for state agencies regarding the use of electronic signatures for legal signing purposes as authorized under the provisions of the Uniform Electronic Transactions Act. These rules are an adaption of the Use of Electronic Signatures in Federal Organization Transactions, Version 1.0 issued January 25, 2013.

[1.12.7.6 NMAC - Rp, NMAC 1.12.7.6, 7/1/2015]

1.12.7.7 DEFINITIONS: For purposes of this part, all terms defined in the Uniform Electronic Transactions Act, Section 14-16-1 et seq NMSA 1978 have the meanings set forth in statute. Additionally, the following terms shall have the following meanings:

A. Terms beginning with the letter “A”:

(1) “Agreement” refer to Uniform Electronic Transactions Act, Section 14-16-2(1) NMSA 1978.

(2) “Attribution” means the process of establishing or confirming that someone is the previously identified person they claim to be.

(3) “Authenticate” refer to Electronic Authentication of Documents Act, Section 14-15-3(A) NMSA 1978.

(4) “Automated transaction” refer to Uniform Electronic Transactions Act, Section 14-16-2(2) NMSA 1978.

B. Terms beginning with the letter “B”:

(1) “Biometrics” means the unique physical characteristics of individuals that can be converted into digital form and then interpreted by a computer. Among these are voice patterns, fingerprints, and the blood vessel patterns present on the retina of one or both eyes.

C. Terms beginning with the letter “C”:

(1) “Click wrap” means a click wrap agreement, also known as click through agreement or click wrap license, that require an end user to manifest his or her assent by clicking a button or pop-up window that says “OK” or “agree” or some similar form. A user indicates rejection by clicking “cancel” or some similar form or by closing browsing window.

(2) “Computer program” refer to Uniform Electronic Transactions Act, Section 14-16-2(3) NMSA 1978.

(3) “Contract” refer to Uniform Electronic Transactions Act, Section 14-16-2(4) NMSA 1978.

(4) “Credential” means a digital document that binds a person’ identity to a token possessed and controlled by a person; data that is used to establish the claimed attributes or identity of a person or an entity. Common paper credentials include passports, birth certificates, driver’s licenses and employee identification cards. Common digital credentials include user IDs and digital certificates. Credentials are a tool for authentication.

(5) “Cryptographic key” means a value used to control cryptographic operations, such as decryption, encryption, signature generation or signature verification.

D. Terms beginning with the letter “D”:

(1) “Digital signature” means any electronic signature that can be used to authenticate the identity of the sender of or signer of a document, and may also ensure that the content of the sent document is unaltered.

(2) “Digitized signature” means a graphical image of a handwritten signature.

(3) “Document” refer to Electronic Authentication of Documents Act, Section 14-15-3(B) NMSA 1978.

E. Terms beginning with the letter “E”:

(1) “Electronic” refer to Uniform Electronic Transactions Act, Section 14-16-2(5) NMSA 1978.

(2) “Electronic agent” refer to Uniform Electronic Transactions Act, Section 14-16-2(6) NMSA 1978.

(3) “Electronic authentication” refers to Electronic Authentication of Documents Act, Section 14-15-3(C) NMSA 1978.

(4) “Electronic record” refer to Uniform Electronic Transactions Act, Section 14-16-2(7) NMSA 1978.

(5) “Electronic signature” refer to Uniform Electronic Transactions Act, Section 14-16-2(8) NMSA 1978.

F. Terms beginning with the letter “F”: [RESERVED]

G. Terms beginning with the letter “G”:

(1) “Governmental agency” refer to Uniform Electronic Transactions Act, Section 14-16-2(9) NMSA 1978.

H. Terms beginning with the letter “H”:

(1) “Hash” or Hash function” means a mathematical function that takes a variable length input string and converts it to a smaller fixed-length output string, that is for all relevant purposes unique to the data used as input to the message digest function. The message digest is, in essence, a digital fingerprint of the data to which it relates.

(2) “Hyperlink” means any electronic link providing direct access from one distinctively marked place in a hypertext or hypermedia document to another in the same or a different document.

I. Terms beginning with the letter “I”:

(1) “Identification” means the process of verifying and associating attributes with a particular person designated by an identifier.

(2) “Identity” means the unique name of an individual person, and any associated attributes; the set of the properties of a person that allows the person to be distinguished from other persons.

(3) “Information” refer to Uniform Electronic Transactions Act, Section 14-16-2(10) NMSA 1978.

(4) “Information processing system” refer to Uniform Electronic Transactions Act, Section 14-16-2(11) NMSA 1978.

(5) “Integrity” means a state in which information has remained unaltered from the point it was produced by a source, during transmission, storage and eventual receipt by the destination.

(6) “Intent to sign” means the intent of a person that a sound, symbol or process is applied to a record in order to have a legally binding effect.

(7) “Level of assurance” means the level of authentication assurance that describes the degree of certainty that a user has presented an identifier that refers to her identity.

J. Terms beginning with the letter “J”: [RESERVED]

K. Terms beginning with the letter “K”: [RESERVED]

L. Terms beginning with the letter “L”: [RESERVED]

M. Terms beginning with the letter “M”:

(1) “Method” means a particular way of doing something, a means, process or manner of procedure, especially a regular and systematic way of accomplishing something and an orderly arrangement of steps to accomplish an end.

N. Terms beginning with the letter “N”:

(1) NIST Special Publication 800-63” refers to the National Institute of Standards and Technology, Special Publication 800-63, Electronic Authentication Guidance.

O. Terms beginning with the letter “O”:

(1) “Originator” refers to Electronic Authentication of Documents Act, Section 14-15-3(E) NMSA 1978.

P. Terms beginning with the letter “P”:

(1) “Password” means a secret word or string of characters that is used for authentication, to prove identity or to gain access to a record or resource. Passwords are typically character strings.

(2) “PDF” or Portable Document Format refers to a file format used to present documents in a manner independent of application software, hardware, and operating systems. A PDF file encapsulates a complete description of a fixed-layout flat document, including the text, fonts, graphics, and other information needed to display it.

(3) “Person” refer to Uniform Electronic Transactions Act, Section 14-16-2(12) NMSA 1978.

(4) “Personal identification number (PIN) means a shared secret a person accessing a government organization’s electronic application is requested to enter, such as a password or PIN. The system checks that password or PIN against data in a database to ensure its correctness and thereby “authenticates” the user.

(5) “Private key” means the code or alphanumeric sequence used to encode an electronic authentication and which is known only to its owner. The private key is the part of a key pair used to create an electronic authentication.

(6) “Public key” means the code or alphanumeric sequence used to decode an electronic authentication. The public key is the part of a key pair used to verify an electronic authentication.

(7) “Public/private key system” means the hardware, software, and firmware that are provided by a vendor for: (a) the generation of public/private key pairs, (b) the record abstraction by means of a secure hash code, (c) the encoding of the signature block and the record abstraction or the entire record, (d) the decoding of the signature block and the record abstraction or the entire record, and (e) the verification of the integrity of the received record.

Q. Terms beginning with the letter “Q”: [RESERVED]

R. Terms beginning with the letter “R”:

(1) “Reason for signing” means the purpose statement of a person with regard to a document or electronic record that is affirmed by signing the document or record. The reason for signing should be distinguished from the intent to sign.

(2) “Record” refer to Uniform Electronic Transactions Act, Section 14-16-2(13) NMSA 1978.

(3) “Record abstraction” means a condensed representation of a document, which condensation is prepared by use of a secure hash code; it is also known as a message digest.

(4) “Repudiate” and “non-repudiation” refer to the acts of denying or proving the origin of a document from its sender, and to the acts of denying or proving the receipt of a document by its recipient.

(5) “Risk” is a function of the likelihood that a given threat will exploit a potential vulnerability and have an adverse impact on an organization.

S. Terms beginning with the letter “S”:

(1) “Secure hash code” is a mathematical algorithm that, when applied to an electronic version of a document, creates a condensed version of the document from which it is computationally infeasible to identify or recreate the document which corresponds to the condensed version of the document without extrinsic knowledge of that correspondence.

(2) “Security procedure” refer to Uniform Electronic Transactions Act, Section 14-16-2(14) NMSA 1978.

(3) “Signed” and “signature” refer to Electronic Authentication of Documents Act, Section 14-15-3(G) NMSA 1978..

(4) “Signature block” means the portion of a document, encoded by the private key, which contains the identity of the originator and the date and time of the records creation, submittal or approval.

(5) “Signing requirements” means the requirements that must be satisfied to create a valid and enforceable electronic signature.

(6) “State” refer to Uniform Electronic Transactions Act, Section 14-16-2(15) NMSA 1978.

T. Terms beginning with the letter “T”:

(1) “TIF” or “TIFF” or Tagged Image Format refers to an image file format for high-quality graphics.

(2) “Threat” means a potential circumstance, entity or event capable of exploiting vulnerability and causing harm. Threats can come from natural causes, human actions, or environmental conditions. A threat does not present a risk when there is no vulnerability. Vulnerability is a weakness that can be accidentally triggered or intentionally exploited.

(3) “Token” refers to something that a person possesses and controls (typically a cryptographic key or password) that is used to authenticate the person’s identity.

(4) “Transaction” refer to Uniform Electronic Transactions Act, Section 14-16-2(16) NMSA 1978.

(5) “Transferable record” means an electronic record that would: (a) be a note under Chapter 55, Article 3 NMSA 1978 or a document under Chapter 55, Article 7 NMSA 1978 if the electronic record were in writing; and (b) the issuer of the electronic record expressly has agreed is a transferable record.

(6) “Trusted entity” means an independent, unbiased third party that contributes to, or provides, important security assurances that enhance the admissibility, enforceability and reliability of information in electronic form. In a public/private key system, a trusted entity registers a digitally signed data structure that binds an entity's name (or identity) with its public key.

U. Terms beginning with the letter “U”: [RESERVED]

V. Terms beginning with the letter “V”:

(1) “Voice signature” means an audio recording created by an individual who intends to sign a particular transaction (or document) and used as the electronic form of signature.

W. Terms beginning with the letter “W”: [RESERVED]

X. Terms beginning with the letter “X”: [RESERVED]

Y. Terms beginning with the letter “Y”: [RESERVED]

Z. Terms beginning with the letter “Z”: [RESERVED]

[1.12.7.7 NMAC - Rp, NMAC 1.12.7.7, 7/1/2015]

1.12.7.8 GENERAL OVERVIEW:

A. A signature, whether electronic or on paper, is the means by which a person indicates an intent to associate oneself with a document in a manner that has legal significance (e.g., to adopt or approve a specific statement regarding, or reason for signing, a document). It constitutes legally-binding evidence of the signer’s intention with regard to a document. The reasons for signing a document will vary with the transaction, and in most cases can be determined only by examining the context in which the signature was made. Generally, a person’s reason for signing a document falls into one of the following categories:

(1) approving, assenting to, or agreeing to the information in the document or record signed (e.g., agreeing to the terms of a contract or inter-agency memorandum or indicating approval for legal sufficiency);

(2) certifying or affirming the accuracy of the information stated in the document or record signed (e.g., certifying that the statements in one’s tax return are true and correct);

(3) acknowledging access to or receipt of information set forth in the document or record signed (e.g., acknowledging receipt of a disclosure document);

(4) witnessing the signature or other act of another (e.g., notarization); or

(5) certifying the source of the information in the document or record signed (e.g., certifying data in a clinical trial record, certifying an inventory count, etc.).

B. The Uniform Electronic Transaction Act sets forth the requirements that must be satisfied by an electronic signature to establish functional equivalence to the paper-based requirement for a signature.

[1.12.7.8 NMAC - Rp, NMAC 1.12.7.8, 7/1/2015]

1.12.7.9 ELECTRONIC SIGNATURES COMPARED TO DIGITAL SIGNATURES:

A. “Electronic signature” is the term used for the electronic equivalent of a handwritten signature. It is a generic, technology- neutral term that refers to the universe of all of the various methods by which one can “sign” an electronic record. Although all electronic signatures may be represented digitally (i.e., as a series of ones and zeroes), they can take many forms and can be created by many different technologies.

B. “Digital signature” is the term used to describe the small segment of encrypted data produced when a specific mathematical process (involving a hash algorithm and public key cryptography) is applied to an electronic record.

[1.12.7.9 NMAC - Rp, NMAC 1.12.7.9, 7/1/2015]

1.12.7.10 ELECTRONIC SIGNATURE, SECURITY PROCEDURE AND SIGNING PROCESS:

A. An electronic signature is used to indicate a person’s intent to associate themselves in some way to information or to a reason for signing (e.g., agreeing to the terms of a contract, acknowledging receipt of information, etc.) with legal effect. Any sound, symbol, or process that is made or adopted by a person with intent to sign a document can be used as the form of signature for purposes of creating an electronic signature. This includes, for example, a typed name, clicking on an “I Agree” button, or a cryptographically created digital signature. But the mere use of any such sound, symbol, or process does not necessarily create a legally binding electronic signature.

B. A security procedure is employed for the purpose of verifying that an electronic record, signature, or performance is that of a specific person or for detecting changes or errors in the information in an electronic record (integrity). A digital signature can be used as both a security procedure and as a legally binding form of signature. It is important that the context make clear whether the digital signature is intended merely for purposes of attribution, integrity, or whether it is also intended to be a legally binding electronic signature.

C. A signing process is the overall set of actions, steps, and elements that is used to create a valid and enforceable electronic signature, and includes both the application to an electronic record of a form of signature (i.e., the sound, symbol, or process) to be used as the electronic signature, and one or more processes or security procedures to address the other signature requirements listed.

[1.12.7.10 NMAC - Rp, NMAC 1.12.7.10, 7/1/2015]

1.12.7.11 LEGAL REQUIREMENT FOR A SIGNATURE: A transaction is governed by a law or regulation that requires the presence of a signature before it will be considered legally effective. A state agency must review the law applicable to each proposed transaction to determine if it requires that the transaction be “signed.” If the applicable law or regulation requires a signature, then to conduct the transaction in electronic form requires an electronic signature.

[1.12.7.11 NMAC - Rp, NMAC 1.12.7.11, 7/1/2015]

1.12.7.12 TRANSACTION-BASED NEED FOR A SIGNATURE: If there is no legal requirement for a signature on a particular type of transaction a state agency may undertake a further analysis to evaluate the desirability of incorporating a signature requirement into the transaction. An electronic signature may be desirable, even when not legally required, where there is a:

A. Need for emphasizing the seriousness of the transaction. A signature may serve to reinforce the significance of the undertaking to the party involved. It gives the transaction a more formal tone, and helps to drive home to the signing party the seriousness of what is being undertaken.

B. Need for binding a party to the transaction. If the transaction involves an intent element (e.g., agreement, approval, acknowledgment, receipt, witnessing, etc.), a signature may be useful to help formally bind a person to that reason for signing and make it more likely to be enforced (e.g., to mitigate concerns regarding repudiation).

[1.12.7.12 NMAC - Rp, NMAC 1.12.7.12, 7/1/2015]

1.12.7.13 REQUIREMENTS FOR LEGALLY BINDING ELECTRONIC SIGNATURE: Where an electronic signature is required by law or otherwise deemed desirable, it is critical that the electronic signature and the associated signing process satisfy all of the applicable legal requirements. Generally, creating a valid and enforceable electronic signature requires satisfying the following signing requirements.

A. A person (i.e., the signer) must use an acceptable electronic form of signature. Electronic signatures can take many forms, and can be created by many different technologies. No specific technology or form of signature is required. Generally, any electronic “sound, symbol, or process” can be used as the form of signature. Examples of commonly used electronic forms of signature include, but are not limited to:

(1) Symbols such as a typed name (e.g., typed at the end of an e-mail message by the sender, or typed into a signature block on a website form by a party); digitized image of a handwritten signature that is attached to an electronic record; a shared secret (e.g., a secret code, password, or PIN) used by a person to sign the electronic record; a unique biometrics-based identifier, such as a fingerprint, voice print, or a retinal scan; or a digital signature.

(2) Sounds such as sound recording of a person’s voice expressing consent.

(3) Processes such as using a mouse to click a button or hyperlink (such as clicking an “I Agree” button); using a private key and applicable software to apply a “digital signature;” or scanning and applying a fingerprint.

B. The electronic form of signature must be executed or adopted by a person with the intent to sign the electronic record, (e.g., to indicate a person’s approval of the information contained in the electronic record). A person’s intent to sign is often inferred from his or her approval of the reason for signing as stated in the text of either: (i) the electronic record being signed or (ii) the surrounding signing process. For example, words appearing immediately above a blank signature line on a contract document might state “By signing below I agree to the foregoing contract terms.” That statement indicates both the reason for signing (agreement to the contract) as well as the means by which a person can indicate an intent to sign (i.e., by applying the form of signature where indicated). Thus, a person indicates his or her intention to sign, for the reason stated, by signing on the applicable blank line. Likewise, text on a website might state that “By checking this box I agree to the terms of use.” A person indicates his or her intention to sign, for the reason stated, by checking the box on the website.

C. The electronic form of signature must be attached to or associated with the electronic record being signed. Specifically, it must be attached to, or logically associated with, the record being signed. Satisfying this requirement requires storing the data constituting the electronic form of signature, and doing so in a way that permanently associates it with the electronic record that was signed. Where the electronic form of signature consists of a symbol or a sound (such as a typed name, a digitized image of a handwritten name, a PIN, a digital signature, a voice recording, etc.), the data representing the symbol or sound must be saved. Where the electronic form of signature consists of a process (such as clicking on an “I Agree” button), the system must be programmed so that completion of the process generates some specific data element to indicate completion of the signing process, or some other procedure (such as generation of a log record or audit trail) to record the act of signing. It is also recommended that the following additional data elements be appended to or associated with the signature data provided privacy considerations have been taken into account:

(1) Identity of the signer or a link to the source of identifying information, such as a validated UserID, a digital certificate, a biometric database, etc.;

(2) Date and time of the signature;

(3) Method used to sign the record; and

(4) An indication of the reason for signing.

D. There must be a means to identify and authenticate a particular person as the signer. Meeting this burden of proof requires establishing a link between an identified person and the signature. An electronic form of signature may or may not provide proof of identity. Many forms of signature do not contain or directly link to the identity of the person making them (such as clicking an “I Agree” button), or if they do provide evidence of identity, such identity may not be reliable (e.g., a typed name). Other security procedures may be used to accomplish this objective. The signer’s identity may be authenticated as part of an overall process of obtaining access to a website or electronic resource that includes the record to be signed. If the act of signing is performed during the session authorized by the authentication process, the signature itself is attributed to the signer because the person accessing the record for signing has been duly authenticated.

E. There must be a means to preserve the integrity of the signed record. The usability, admissibility, and provability of a signed electronic record requires procedures be undertaken to ensure the continuing integrity of both the electronic record and its electronic signature following completion of the signing process. Data integrity is concerned with the accuracy and completeness of electronic information communicated over the internet or stored in an electronic system, and with ensuring that no unauthorized alterations are made to such information either intentionally or accidentally. Ensuring “integrity” requires “guarding against improper information modification or destruction, for the full retention period of the record. Electronic records are easily altered in a manner that is not detectable. In an electronic transaction of any significance, the parties to the transaction must be confident of the integrity of the information before they rely or act on the record.

[1.12.7.13 NMAC - Rp, NMAC 1.12.7.13, 7/1/2015]

1.12.7.14 BUSINESS ANALYSIS AND RISK ASSESSMENT:

A. The selection of an electronic signature process is a business decision involving more than technical consideration. State agencies are strongly encouraged to complete and document a business analysis and risk assessment. The extent, level of detail, and format of the business analysis and risk assessment is up to the state agency. The goal is to implement a signing process that is reliable as is appropriate for the purpose in question.

B. A state agency may evaluate each factor differently and accord them different weights based on the nature and specifics of the underlying transaction. A state agency may also devise its own process for conducting and documenting a business analysis and risk assessment in the selection of an electronic signature process.

C. Business analysis. The focus of the business analysis is the business transaction that the electronic signature will support and the larger related business process. The business analysis may include the following components: overview of the business process, analysis of legal and regulatory requirement specifically related to the transaction, identification of industry standards or generally accepted practices related to the transaction, analysis of those who will use electronically signed records and related requirements, and determination of interoperability requirements including those of business partners, determination of the cost of alternative approaches.

D. Risk Assessment. The selection of an appropriate electronic signature process includes identifying the potential risks involved in a signed electronic transaction and how various electronic signature approaches can address those risks. This paragraph draws upon the national institute of standards (NIST) approach to risk assessment but is more narrowly focused on the risks inherent in a signed electronic transaction. To assess risks, a state agency should identify and analyze: sources of threats, vulnerabilities (such as repudiation, intrusion, loss of access to records for business and legal purposes), potential impacts (such as financial, reputation and credibility, productivity), and likelihood that a threat will actually materialize.

E. Risk Matrix. A state agency may wish to develop a matrix in which risk level for each threat is determined by the relationship between the threat’s likelihood and the degree of impact against the background of existing risk reduction measures. The greatest risks are those that have extreme consequences and almost certain to occur. Conversely, a rare event with negligible consequences may be considered trivial.

F. Both the analysis of the likelihood of a successful challenge to the enforceability of a signature and the analysis of the cost or impact of an unenforceable signature should result in a “Low,” “Moderate” or “High” determination.

G. The Department of Information Technology has statutory responsibility for all state-wide, executive agency information and computer systems. Given the specific and particular expertise of the Department, any state agency may defer to any determination made by the Secretary of the Department of Information and Technology as to ‘business analysis’, ‘risk assessment’, or constructing a ‘risk matrix’.

[1.12.7.14 NMAC - Rp, NMAC 1.12.7.14, 7/1/2015]

1.12.7.15 ELECTRONIC FORM OF SIGNATURE:

A. Low risk transactions.

(1) For low risk transactions, any form of signature is acceptable. This includes clicking an on-screen button, checking an on-screen box, typing ones name, using a PIN number, or any other reasonable method, so long as it is clear to the signer that such act constitutes a signature, and is not being done for any other purpose.

(2) Evidence of intent to sign may be included either in the record being signed or in the on-screen signing process. Shorter or more cursory indicators of intent may be used as necessary to facilitate the signing experience, so long as it is reasonably clear to the signer that they are signing the record, not doing something else.

(3) Any method may be used to associate the signature to the records being signed. This can include establishing a process that could not be completed unless a person has signed; using a process that appends the signature date to the record signed; or establishing a database-type link between the signature date and the records signed.

(4) Any approach to identification and authentication of the signer is acceptable. This includes self-assertion of identity by the signer. Successful authentication at this level requires that the signer prove through a secure authentication protocol that they possess and control the token. However, this level does not require cryptographic methods that block offline attacks. Refer to NIST Special Publication 800-63-2 for additional information related to electronic authentication guidelines.

(5) The system or application must be reasonably trusted to invalidate signature upon modification of the record and provide a secure method to transfer and store the signed record.

B. Moderate risk transactions.

(1) For moderate risk transactions, any electronic form of signature is acceptable. This includes clicking an on-screen box, typing ones name, using a PIN number, or any other reasonable method, so long as it is clear to the signer that such act constitutes a signature, and is not being done for any other purpose.

(2) Evidence of intent to sign may be included either in the records being signed or in the on-screen signing process. Clear evidence of intent to sign must be unmistakably provided. Shorter or more cursory indicators of intent should be avoided in favor of clear evidence of intent to facilitate the signing experience, so that it is very clear to the signer that they are signing the record.

(3) Any reasonable method may be used to associate the signature data to the records signed, or establishing a database-type link between the signature data and the records signed. The signing data can then be either attached or appended to the records signed, or a database-type link can be established between the signature data and the record signed.

(4) A single factor remote network authentication is acceptable for medium level risk transactions. There are a wide range of available authentication technologies that can be employed. For example, memorized secret tokens, pre-registered knowledge tokens, look-up secret tokens, out of band tokens and single factor one-time password devises are acceptable. This level requires cryptographic techniques and successful authentication requires that the signer prove through a secure authentication protocol that they control the token. Refer to NIST Special Publication 800-63-2 for additional information related to electronic authentication guidelines.

(5) The system or application must be reasonably trusted to invalidate signature upon modification of the record and provide a secure method to transfer and store the signed record.

C. High risk transactions.

(1) For high risk transactions, the only acceptable electronic form of signature is a cryptographically based digital signature created with a private cryptographic key that corresponds to the public key specified in a digital credential list.

(2) Evidence of intent to sign must be included both in the record being signed and in the on-screen signing process. Such evidence of intent to sign must be clearly provided in both places and make it unmistakable to the signer that they are signing the record and the reason that they are signing.

(3) A cryptographic signing process whereby a hash of the content of the record being signed is incorporated into the signature data must be used so there is an intrinsic relationship between the signature data and the record signed. The signing data can then be either attached or appended to the record signed, or a database-type link can be established between the signature data and the record signed.

(4) The signer must be identified and authenticated by reference to a digital certificate that provides at least two authentication factors or is based on proof of possession of a key through a cryptographic protocol.

(5) The system or application must be digitally signed using the identification and authentication specified in 1.12.7.15(4) NMAC that will invalidate signature upon modification of the record and provide a secure method to transfer and store the signed record.

[1.12.7.15 NMAC - Rp, NMAC 1.12.7.15, 7/1/2015]

HISTORY OF 1.12.7 NMAC:

History of Repealed Material:

1 NMAC 3.2.70.2, Records - Information Technology Systems - Electronic Authentication, filed 4/1/97 - Repealed 6/30/15.